@agiledigital/pingone-aic-script-tester 0.1.0

package/dist/src/jvm.js

@@ -0,0 +1,432 @@
+import { execFile } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, lstatSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter, join } from "node:path";
+import { promisify } from "node:util";
+import { javaSourceDir, prebuiltClassesDir } from "./paths.js";
+const execFileAsync = promisify(execFile);
+export const JVM_LANE_ENV = "AIC_SCRIPT_TESTER_JVM";
+export function laneFromEnv(env = process.env) {
+    const raw = env[JVM_LANE_ENV];
+    if (raw === undefined || raw === "" || raw === "host") {
+        return "host";
+    }
+    if (raw === "container" || raw === "both") {
+        return raw;
+    }
+    throw new Error(`rhino-local: ${JVM_LANE_ENV} must be host, container or both, not ${JSON.stringify(raw)}`);
+}
+/**
+ * The Rhino AM 8.1.1 ships. MEASURED 2026-09-28: the jar in
+ * `WEB-INF/lib` of the AM image is byte-identical to this Maven Central
+ * artefact (same SHA-1 as the `.sha1` Central publishes), so there is no Ping
+ * code to extract and nothing about Rhino that needs the image.
+ */
+export const RHINO_JAR = {
+    fileName: "rhino-1.7.14.1.jar",
+    url: "https://repo1.maven.org/maven2/org/mozilla/rhino/1.7.14.1/rhino-1.7.14.1.jar",
+    sha256: "407d4af6521494061d86b208e99804e0bf5c2fa38449c48f24b2f5a7154b4d8d",
+    bytes: 1_389_188,
+};
+/**
+ * The AM image the `container` lane runs, pinned by digest so the reference
+ * cannot move under a re-pushed tag; override to calibrate another image.
+ */
+export const DEFAULT_AM_IMAGE = "us-docker.pkg.dev/forgeops-public/images/am:2026.3.1-2053" +
+    "@sha256:358d7e1e13b27619b742a759fd5a85d4fcc57cc75811027b9f3c0019a0bd9be3";
+/**
+ * The JVM AM runs, as the AM image reports it (MEASURED 2026-09-28):
+ * Temurin-25.0.4+7, `/etc/localtime` → `Etc/UTC`, `LANG=en_US.UTF-8`. The
+ * runner reports what it actually got at startup, and {@link checkEnvironment}
+ * refuses a JVM that differs in anything a script could observe.
+ */
+export const EXPECTED_ENVIRONMENT = {
+    javaFeature: 25,
+    timezone: "Etc/UTC",
+    locale: "en-US",
+    charset: "UTF-8",
+    rhino: "Rhino 1.7.14.1",
+};
+/**
+ * Flags for the host lane only. The properties pin what the AM image's JVM
+ * gets from its OS (UTC, en_US.UTF-8), which a host would otherwise take from
+ * its own settings. The heap cap, serial collector and C1-only JIT are what
+ * keep a runner small on an 8GB box.
+ *
+ * The container lane gets **none** of these: it is the reference, so it runs
+ * the image's JVM on the image's defaults, as the old launcher did. That makes
+ * `both` compare the constrained host against an unconstrained AM JVM, so a
+ * script that only works with more heap or a faster JIT shows up as a
+ * divergence rather than agreeing with itself.
+ */
+export const HOST_JVM_FLAGS = [
+    "-Duser.timezone=Etc/UTC",
+    "-Duser.language=en",
+    "-Duser.country=US",
+    "-Dfile.encoding=UTF-8",
+    "-Dstdout.encoding=UTF-8",
+    "-Dstderr.encoding=UTF-8",
+    "-Xmx256m",
+    "-XX:+UseSerialGC",
+    "-XX:TieredStopAtLevel=1",
+];
+export function parseEnvironment(readyLine) {
+    const json = readyLine.replace(/^.*?rhino-local-runner ready\s*/, "");
+    let raw;
+    try {
+        raw = JSON.parse(json);
+    }
+    catch {
+        throw new Error(`rhino-local: the runner's ready line carries no environment (${JSON.stringify(readyLine)}); ` +
+            "its classes predate this client — delete the rhino-local cache");
+    }
+    if (typeof raw !== "object" || raw === null) {
+        throw new Error(`rhino-local: runner environment is not an object: ${json}`);
+    }
+    const r = raw;
+    const str = (key) => {
+        const value = r[key];
+        if (typeof value !== "string") {
+            throw new Error(`rhino-local: runner environment is missing ${key}: ${json}`);
+        }
+        return value;
+    };
+    if (typeof r.javaFeature !== "number") {
+        throw new Error(`rhino-local: runner environment is missing javaFeature: ${json}`);
+    }
+    return {
+        javaFeature: r.javaFeature,
+        javaVersion: str("javaVersion"),
+        javaVendorVersion: typeof r.javaVendorVersion === "string" ? r.javaVendorVersion : null,
+        timezone: str("timezone"),
+        locale: str("locale"),
+        charset: str("charset"),
+        rhino: str("rhino"),
+    };
+}
+/**
+ * Every field a script can observe must match AM's. The Java patch level and
+ * vendor are not checked here: they are what the `both` lane measures, and a
+ * developer's Temurin 25.0.4.1 is not wrong merely for not being 25.0.4.
+ */
+export function checkEnvironment(env, lane) {
+    const problems = [];
+    for (const key of Object.keys(EXPECTED_ENVIRONMENT)) {
+        if (env[key] !== EXPECTED_ENVIRONMENT[key]) {
+            problems.push(`${key} is ${JSON.stringify(env[key])}, AM's is ${JSON.stringify(EXPECTED_ENVIRONMENT[key])}`);
+        }
+    }
+    if (problems.length > 0) {
+        const remedy = lane === "host" && env.javaFeature !== EXPECTED_ENVIRONMENT.javaFeature
+            ? ` Point ${JAVA_HOME_ENV} (or JAVA_HOME) at a Java ${EXPECTED_ENVIRONMENT.javaFeature} — AM runs Temurin ${EXPECTED_ENVIRONMENT.javaFeature}.`
+            : "";
+        throw new Error(`rhino-local: the ${lane} JVM does not match AM: ${problems.join("; ")}.${remedy}`);
+    }
+}
+export const JAVA_HOME_ENV = "AIC_SCRIPT_TESTER_JAVA_HOME";
+/** `bin/<tool>` under AIC_SCRIPT_TESTER_JAVA_HOME, then JAVA_HOME, else the bare name for PATH lookup. */
+export function javaTool(tool, env = process.env) {
+    const home = env[JAVA_HOME_ENV] || env.JAVA_HOME;
+    return home ? join(home, "bin", tool) : tool;
+}
+export function cacheDir(env = process.env) {
+    if (env.AIC_SCRIPT_TESTER_CACHE) {
+        return env.AIC_SCRIPT_TESTER_CACHE;
+    }
+    return join(env.XDG_CACHE_HOME || join(homedir(), ".cache"), "aic-script-tester");
+}
+function sha256(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+const javacVersions = new Map();
+async function javacVersion(javac) {
+    let version = javacVersions.get(javac);
+    if (!version) {
+        version = execFileAsync(javac, ["-version"], { timeout: 30_000, maxBuffer: 100_000 })
+            .then(({ stdout, stderr }) => `${stdout}${stderr}`.trim())
+            .catch((error) => {
+            javacVersions.delete(javac);
+            throw error;
+        });
+        javacVersions.set(javac, version);
+    }
+    return version;
+}
+function outputFiles(root, relative = "") {
+    const dir = relative ? join(root, relative) : root;
+    const files = [];
+    for (const entry of readdirSync(dir)) {
+        const child = relative ? join(relative, entry) : entry;
+        const path = join(root, child);
+        if (lstatSync(path).isDirectory())
+            files.push(...outputFiles(root, child));
+        else
+            files.push(child);
+    }
+    return files.sort();
+}
+/**
+ * The first published directory for `digest` whose manifest still holds.
+ * One that does not — a class deleted, altered or added since — is removed:
+ * names are never reused, so no worker can be about to publish over it, and
+ * a worker already running from it is running damaged classes regardless.
+ */
+function findValidClasses(classesDir, digest) {
+    let names;
+    try {
+        names = readdirSync(classesDir);
+    }
+    catch {
+        return undefined;
+    }
+    for (const name of names.filter((n) => n.startsWith(`${digest}-`)).sort()) {
+        const dir = join(classesDir, name);
+        if (validRunnerCache(dir, digest)) {
+            return dir;
+        }
+        rmSync(dir, { recursive: true, force: true });
+    }
+    return undefined;
+}
+function validRunnerCache(dest, digest) {
+    const marker = join(dest, ".complete");
+    if (!existsSync(marker))
+        return false;
+    try {
+        const lines = readFileSync(marker, "utf8").trimEnd().split("\n");
+        if (lines[0] !== digest || lines.length < 2)
+            return false;
+        const entries = lines.slice(1);
+        const listed = new Set();
+        let previous = "";
+        for (const line of entries) {
+            const match = /^([a-f0-9]{64})\x20{2}(.+)$/.exec(line);
+            const relative = match?.[2];
+            if (!match || !relative || relative <= previous || relative === ".complete")
+                return false;
+            previous = relative;
+            listed.add(relative);
+            if (sha256(readFileSync(join(dest, relative))) !== match[1])
+                return false;
+        }
+        return outputFiles(dest)
+            .filter((file) => file.endsWith(".class"))
+            .every((file) => listed.has(file));
+    }
+    catch {
+        return false;
+    }
+}
+/** A local copy of {@link RHINO_JAR} to use instead of the cache or a download. */
+export const RHINO_JAR_ENV = "AIC_SCRIPT_TESTER_RHINO_JAR";
+async function defaultFetch(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new Error(`rhino-local: GET ${url} returned ${response.status}`);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+}
+/**
+ * The Rhino jar, verified by SHA-256 every time it is used, not only when
+ * downloaded: a cache is a file anyone can overwrite, and a different Rhino
+ * would make every verdict in this harness a claim about the wrong engine.
+ */
+export async function ensureRhinoJar(cache = cacheDir(), fetcher = defaultFetch, env = process.env) {
+    const override = env[RHINO_JAR_ENV];
+    if (override !== undefined && override !== "") {
+        // For machines that cannot reach Maven Central. Checked like a download:
+        // a path is not a promise about what is at it.
+        let actual;
+        try {
+            actual = sha256(readFileSync(override));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new Error(`rhino-local: ${RHINO_JAR_ENV}=${override} cannot be read: ${detail}`, {
+                cause: error,
+            });
+        }
+        if (actual !== RHINO_JAR.sha256) {
+            throw new Error(`rhino-local: ${RHINO_JAR_ENV}=${override} is not the Rhino AM ships ` +
+                `(sha256 ${actual}; expected ${RHINO_JAR.sha256}, ${RHINO_JAR.fileName} from ${RHINO_JAR.url})`);
+        }
+        return override;
+    }
+    const dir = join(cache, "jars");
+    const path = join(dir, RHINO_JAR.fileName);
+    if (existsSync(path)) {
+        const actual = sha256(readFileSync(path));
+        if (actual === RHINO_JAR.sha256) {
+            return path;
+        }
+        rmSync(path, { force: true });
+    }
+    const bytes = await fetcher(RHINO_JAR.url);
+    const actual = sha256(bytes);
+    if (actual !== RHINO_JAR.sha256 || bytes.length !== RHINO_JAR.bytes) {
+        throw new Error(`rhino-local: ${RHINO_JAR.url} is not the Rhino AM ships ` +
+            `(sha256 ${actual}, ${bytes.length} bytes; expected ${RHINO_JAR.sha256}, ${RHINO_JAR.bytes})`);
+    }
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.${RHINO_JAR.fileName}.${randomUUID()}`);
+    writeFileSync(tmp, bytes);
+    renameSync(tmp, path);
+    return path;
+}
+function runnerSources(dir) {
+    const names = readdirSync(dir)
+        .filter((name) => name.endsWith(".java"))
+        .sort();
+    if (names.length === 0) {
+        throw new Error(`rhino-local: no Java sources in ${dir}`);
+    }
+    const key = createHash("sha256");
+    key.update(RHINO_JAR.sha256);
+    for (const name of names) {
+        key.update(`\0${name}\0`);
+        key.update(readFileSync(join(dir, name)));
+    }
+    return { dir, names, sourceDigest: key.digest("hex").slice(0, 16) };
+}
+async function compileRunner(javac, jar, sources, out, prebuilt) {
+    try {
+        await execFileAsync(javac, [
+            "-encoding",
+            "UTF-8",
+            "--release",
+            String(EXPECTED_ENVIRONMENT.javaFeature),
+            "-cp",
+            jar,
+            "-d",
+            out,
+            ...sources.names.map((name) => join(sources.dir, name)),
+        ], { timeout: 120_000, maxBuffer: 4_000_000 });
+    }
+    catch (error) {
+        throw new Error(noClassesMessage(javac, prebuilt, error), { cause: error });
+    }
+}
+function noClassesMessage(javac, prebuilt, error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return (`rhino-local: compiling the runner with ${javac} failed. There are no prebuilt classes ` +
+        `for these sources at ${prebuilt}, so it needs a JDK ${EXPECTED_ENVIRONMENT.javaFeature} ` +
+        `(set ${JAVA_HOME_ENV} or JAVA_HOME): ${detail}`);
+}
+function writeManifest(dir, digest) {
+    const manifest = outputFiles(dir).map((file) => `${sha256(readFileSync(join(dir, file)))}  ${file}`);
+    writeFileSync(join(dir, ".complete"), `${digest}\n${manifest.join("\n")}\n`);
+}
+/**
+ * The runner classes to launch. First the package's prebuilt classes, when
+ * their manifest names these exact sources and every class still hashes as
+ * recorded — an installed package, which may have no `javac` at all. Otherwise
+ * classes compiled here, keyed by the Java sources, the compiler and the jar
+ * they compile against, so an edit to a `.java` file cannot run stale
+ * bytecode. Each compile goes to a scratch directory and is renamed to a
+ * **fresh** `<digest>-<uuid>` name, never to a shared one: Vitest spawns
+ * runners from several workers at once, and a name that is never reused
+ * cannot be replaced or moved after another worker has validated and returned
+ * it. Two cold workers may both publish; the copies are identical and the
+ * lowest valid name wins from then on.
+ */
+export async function ensureRunnerClasses(jar, options = {}) {
+    const cache = options.cache ?? cacheDir();
+    const sources = runnerSources(options.sources ?? javaSourceDir);
+    const prebuilt = options.prebuilt ?? prebuiltClassesDir;
+    if (validRunnerCache(prebuilt, sources.sourceDigest)) {
+        return prebuilt;
+    }
+    const javac = options.javac ?? javaTool("javac");
+    let compiler;
+    try {
+        compiler = await javacVersion(javac);
+    }
+    catch (error) {
+        throw new Error(noClassesMessage(javac, prebuilt, error), { cause: error });
+    }
+    const digest = createHash("sha256")
+        .update(`${sources.sourceDigest}\0javac\0${compiler}`)
+        .digest("hex")
+        .slice(0, 16);
+    const classesDir = join(cache, "classes");
+    const found = findValidClasses(classesDir, digest);
+    if (found !== undefined) {
+        return found;
+    }
+    const scratch = join(classesDir, `.${digest}.${randomUUID()}`);
+    mkdirSync(scratch, { recursive: true });
+    try {
+        await compileRunner(javac, jar, sources, scratch, prebuilt);
+        writeManifest(scratch, digest);
+        const dest = join(classesDir, `${digest}-${randomUUID()}`);
+        renameSync(scratch, dest);
+        return dest;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Compile the classes a package ships (`npm run build`). Their manifest is
+ * keyed by the sources alone, not the compiler: the consumer running them has
+ * no `javac` to key by, and `--release` fixes the class-file target.
+ */
+export async function buildPrebuiltClasses(options = {}) {
+    const out = options.out ?? prebuiltClassesDir;
+    const jar = await ensureRhinoJar(options.cache ?? cacheDir());
+    const sources = runnerSources(options.sources ?? javaSourceDir);
+    const scratch = `${out}.${randomUUID()}`;
+    mkdirSync(scratch, { recursive: true });
+    try {
+        await compileRunner(options.javac ?? javaTool("javac"), jar, sources, scratch, out);
+        writeManifest(scratch, sources.sourceDigest);
+        rmSync(out, { recursive: true, force: true });
+        renameSync(scratch, out);
+        return out;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+export function hostLaunch(classes, jar, env = process.env) {
+    return {
+        command: javaTool("java", env),
+        args: [...HOST_JVM_FLAGS, "-cp", `${classes}${delimiter}${jar}`, "Runner"],
+        // TZ as well as -Duser.timezone: the property wins for java.util, but a
+        // host TZ still leaks into anything that asks the OS.
+        env: { ...env, TZ: "Etc/UTC" },
+    };
+}
+export function containerLaunch(classes, jar, env = process.env) {
+    const containerName = `rhino-local-runner-${randomUUID()}`;
+    const image = env.AIC_SCRIPT_TESTER_IMAGE || DEFAULT_AM_IMAGE;
+    const user = typeof process.getuid === "function"
+        ? [`--user`, `${process.getuid()}:${process.getgid?.() ?? 0}`]
+        : [];
+    return {
+        command: "docker",
+        args: [
+            "run",
+            "--rm",
+            "-i",
+            "--network",
+            "none",
+            "--name",
+            containerName,
+            ...user,
+            "-v",
+            `${classes}:/rhino-local/classes:ro`,
+            "-v",
+            `${jar}:/rhino-local/rhino.jar:ro`,
+            "--entrypoint",
+            "/opt/java/openjdk/bin/java",
+            image,
+            "-cp",
+            "/rhino-local/classes:/rhino-local/rhino.jar",
+            "Runner",
+        ],
+        env,
+        containerName,
+    };
+}

package/dist/src/load.d.ts

@@ -0,0 +1,2 @@
+import type { ContextsDocument } from "./schema.ts";
+export declare function loadContext(path: string): ContextsDocument;

package/dist/src/load.js

@@ -0,0 +1,104 @@
+import { readFileSync } from "node:fs";
+import { JS_TYPES } from "./schema.js";
+const JS_TYPE_SET = new Set(JS_TYPES);
+export function loadContext(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`rhino-local: cannot parse ${path}: ${String(error)}`, { cause: error });
+    }
+    return parseDocument(parsed, path);
+}
+function parseDocument(raw, path) {
+    if (!isRecord(raw)) {
+        throw new Error(`rhino-local: ${path} is not an object`);
+    }
+    if (typeof raw._id !== "string" || raw._id.length === 0) {
+        throw new Error(`rhino-local: ${path} is missing _id`);
+    }
+    if (!Array.isArray(raw.bindings)) {
+        throw new Error(`rhino-local: ${path} is missing bindings[]`);
+    }
+    return {
+        _id: raw._id,
+        bindings: raw.bindings.map((binding, index) => parseBinding(binding, `${path} bindings[${index}]`)),
+    };
+}
+function parseBinding(raw, path) {
+    if (!isRecord(raw)) {
+        throw new Error(`rhino-local: ${path} is not an object`);
+    }
+    if (typeof raw.name !== "string") {
+        throw new Error(`rhino-local: ${path} is missing name`);
+    }
+    return {
+        name: raw.name,
+        javaScriptType: parseJsType(raw.javaScriptType, `${path}.javaScriptType`),
+        elements: parseElements(raw.elements, `${path}.elements`),
+    };
+}
+function parseElements(raw, path) {
+    if (raw === undefined || raw === null) {
+        return [];
+    }
+    if (!Array.isArray(raw)) {
+        throw new Error(`rhino-local: ${path} is not an array`);
+    }
+    return raw.map((element, index) => parseElement(element, `${path}[${index}]`));
+}
+function parseElement(raw, path) {
+    if (!isRecord(raw)) {
+        throw new Error(`rhino-local: ${path} is not an object`);
+    }
+    if (typeof raw.name !== "string") {
+        throw new Error(`rhino-local: ${path} is missing name`);
+    }
+    if (raw.elementType === "method") {
+        return {
+            elementType: "method",
+            name: raw.name,
+            parameters: parseParameters(raw.parameters, `${path}.parameters`),
+            returnType: parseJsType(raw.returnType, `${path}.returnType`),
+        };
+    }
+    if (raw.elementType === "field") {
+        return {
+            elementType: "field",
+            name: raw.name,
+            javaScriptType: parseJsType(raw.javaScriptType, `${path}.javaScriptType`),
+            elements: parseElements(raw.elements, `${path}.elements`),
+        };
+    }
+    throw new Error(`rhino-local: ${path} has unknown elementType ${JSON.stringify(raw.elementType)}`);
+}
+function parseParameters(raw, path) {
+    if (raw === undefined || raw === null) {
+        return [];
+    }
+    if (!Array.isArray(raw)) {
+        throw new Error(`rhino-local: ${path} is not an array`);
+    }
+    return raw.map((parameter, index) => {
+        if (!isRecord(parameter)) {
+            throw new Error(`rhino-local: ${path}[${index}] is not an object`);
+        }
+        if (typeof parameter.name !== "string") {
+            throw new Error(`rhino-local: ${path}[${index}] is missing name`);
+        }
+        return {
+            name: parameter.name,
+            javaScriptType: parseJsType(parameter.javaScriptType, `${path}[${index}].javaScriptType`),
+        };
+    });
+}
+function parseJsType(raw, path) {
+    if (typeof raw !== "string" || !JS_TYPE_SET.has(raw)) {
+        throw new Error(`rhino-local: ${path} unexpected javaScriptType ${JSON.stringify(raw)}`);
+    }
+    return raw;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/src/paths.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The directory holding this package's `package.json`: `packages/rhino-local/`
+ * in the repo, `node_modules/<name>/` installed. Found by walking up, because
+ * the compiled copy of this file sits one level deeper (`dist/src/`) than the
+ * source does.
+ */
+export declare const packageRoot: string;
+/**
+ * pingone-aic-manager repo root. **Repo-only**: generation and this repo's
+ * tests read through it; nothing under `src/` may use it at run time,
+ * because an installed package has no repo around it
+ * (`test/paths.test.ts` enforces that).
+ */
+export declare const repoRoot: string;
+/** The runner's Java sources (`packages/rhino-local/java/*.java`). */
+export declare const javaSourceDir: string;
+/**
+ * Runner classes compiled at build time and shipped, so a consumer needs a
+ * `java` but no `javac`. Used only while their manifest matches
+ * {@link javaSourceDir}; absent in a checkout until `npm run build`.
+ */
+export declare const prebuiltClassesDir: string;
+/** The captured contexts JSON in this repo's docs. Repo-only; read by `generate`. */
+export declare const sourceBindingsJsonPath: string;
+export declare const generatedDir: string;
+/** `generate`'s verbatim copy of {@link sourceBindingsJsonPath}, shipped with the package. */
+export declare const bindingsJsonPath: string;
+export declare const generatedJsPath: string;
+export declare const generatedDtsPath: string;
+/** Handwritten AM-safe overlay that implements a subset of the generated stubs. */
+export declare const bindingsRuntimePath: string;
+/** Scripted-decision case files (author scripts + defineCase wrappers). */
+export declare const casesDir: string;
+export declare const amRhinoEslintConfigPath: string;
+/** This repo's AM script lint. Repo-only: the lockstep test reads it. */
+export declare const amEslintConfigPath: string;

package/dist/src/paths.js

@@ -0,0 +1,50 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const here = dirname(fileURLToPath(import.meta.url));
+/**
+ * The directory holding this package's `package.json`: `packages/rhino-local/`
+ * in the repo, `node_modules/<name>/` installed. Found by walking up, because
+ * the compiled copy of this file sits one level deeper (`dist/src/`) than the
+ * source does.
+ */
+export const packageRoot = findPackageRoot(here);
+function findPackageRoot(start) {
+    for (let dir = start;; dir = dirname(dir)) {
+        if (existsSync(join(dir, "package.json"))) {
+            return dir;
+        }
+        if (dirname(dir) === dir) {
+            throw new Error(`rhino-local: no package.json above ${start}`);
+        }
+    }
+}
+/**
+ * pingone-aic-manager repo root. **Repo-only**: generation and this repo's
+ * tests read through it; nothing under `src/` may use it at run time,
+ * because an installed package has no repo around it
+ * (`test/paths.test.ts` enforces that).
+ */
+export const repoRoot = join(packageRoot, "..", "..");
+/** The runner's Java sources (`packages/rhino-local/java/*.java`). */
+export const javaSourceDir = join(packageRoot, "java");
+/**
+ * Runner classes compiled at build time and shipped, so a consumer needs a
+ * `java` but no `javac`. Used only while their manifest matches
+ * {@link javaSourceDir}; absent in a checkout until `npm run build`.
+ */
+export const prebuiltClassesDir = join(packageRoot, "dist", "classes");
+/** The captured contexts JSON in this repo's docs. Repo-only; read by `generate`. */
+export const sourceBindingsJsonPath = join(repoRoot, "docs", "api", "bindings", "scripted-decision-next.json");
+export const generatedDir = join(packageRoot, "generated");
+/** `generate`'s verbatim copy of {@link sourceBindingsJsonPath}, shipped with the package. */
+export const bindingsJsonPath = join(generatedDir, "scripted-decision-next.json");
+export const generatedJsPath = join(generatedDir, "scripted-decision-mocks.cjs");
+export const generatedDtsPath = join(generatedDir, "scripted-decision-mocks.d.ts");
+/** Handwritten AM-safe overlay that implements a subset of the generated stubs. */
+export const bindingsRuntimePath = join(packageRoot, "src", "bindings", "rhino", "runtime.cjs");
+/** Scripted-decision case files (author scripts + defineCase wrappers). */
+export const casesDir = join(packageRoot, "cases");
+export const amRhinoEslintConfigPath = join(packageRoot, "eslint.am.config.js");
+/** This repo's AM script lint. Repo-only: the lockstep test reads it. */
+export const amEslintConfigPath = join(repoRoot, "src", "scripts", "templates", "am", "eslint.config.js");

package/dist/src/profile/index.d.ts

@@ -0,0 +1,5 @@
+export { MANAGED_CONFIG_ENDPOINT, pullProfile } from "./pull.ts";
+export type { PullOptions } from "./pull.ts";
+export { parseProfile, profilePath, readProfile, tryReadProfile, writeProfile } from "./store.ts";
+export { ProfileShapeError } from "./normalise.ts";
+export type { EnvProfile, ObjectSchema, PropertySchema } from "./types.ts";

package/dist/src/profile/index.js

@@ -0,0 +1,3 @@
+export { MANAGED_CONFIG_ENDPOINT, pullProfile } from "./pull.js";
+export { parseProfile, profilePath, readProfile, tryReadProfile, writeProfile } from "./store.js";
+export { ProfileShapeError } from "./normalise.js";

package/dist/src/profile/normalise.d.ts

@@ -0,0 +1,16 @@
+import type { EnvProfile } from "./types.ts";
+export declare class ProfileShapeError extends Error {
+    constructor(message: string);
+}
+/**
+ * Normalise `GET /openidm/config/managed` into an `EnvProfile`.
+ *
+ * Pure, so the wire shape is testable without a tenant. Unknown keys are
+ * dropped rather than carried: this profile is consumed by validation, and a
+ * field nothing reads is a field that rots silently.
+ */
+export declare function normaliseManagedConfig(document: unknown, meta: {
+    tenant: string;
+    pulledAt: string;
+    endpoint: string;
+}): EnvProfile;